Re: Possibly security vulnerability

Josef,

I committed the attached patch to fix this issue.

Jean-Louis

On 30/01/17 08:10 AM, Josef Ridky wrote:
> Hi folks,
>
> I have found following warning in amanda build log. It will be great to solve it (but not necessary).
>
> common-src/krb5-security.c:393:5: warning: The return value from the call to 'setreuid' is not checked. If an error occurs in 'setreuid', the following code may execute with unexpected privileges
>
> Regards
>
> Josef Ridky
> Associate Software Engineer
> Core Services Team
> Red Hat Czech, s.r.o.

diff --git a/common-src/krb5-security.c b/common-src/krb5-security.c
index 3f932ec..0c9258b 100644
--- a/common-src/krb5-security.c
+++ b/common-src/krb5-security.c
@@ -394,7 +394,10 @@ krb5_accept(
      *(making the userid equal to the dumpuser)
      */
     pw = getpwnam(CLIENT_LOGIN);
-    setreuid(pw->pw_uid, pw->pw_uid);
+    if (setreuid(pw->pw_uid, pw->pw_uid) == -1) {
+	g_critical("setreuid failed: %s", strerror(errno));
+	exit(1);
+    }
 }
 
 /*